The Doctor Appointment System 1.0 contains a cross‑site scripting vulnerability in the registration page. User input submitted in register.php is reflected without proper sanitization, allowing an attacker to embed malicious JavaScript. If a victim visits a page containing this injected script, the code runs within the victim’s browser context, potentially stealing session cookies, defacing content, or delivering phishing payloads This flaw directly exposes confidentiality of user data and enables arbitrary script execution on the client side. The weakness corresponds to improper input validation (CWE‑79).

This issue affects the SourceCodester Doctor Appointment System 1.0 as distributed. No additional vendor or version details are provided beyond the 1.0 release.

The exploitability is straightforward: an attacker only needs to craft a malicious registration attempt and entice a legitimate user to load the affected page. Because it relies on user‑supplied data, the vulnerability can be triggered without special privileges. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of input sanitization makes it a common target. The CVSS score is not provided, but the high impact of client‑side script execution suggests a moderate to high severity.